Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows 2003 web server sitting behind a Cisco Pix 515 firewall. HTTP access is fine, but I can't make FTP access to work.

The configuration I'm trying:

fixup protocol ftp 20
static (inside,outside) <external-IP> <internal-IP> netmask 255.255.255.255 0 0
conduit permit tcp host <external-IP> eq www any
conduit permit tcp host <external-IP> eq ftp-data any
conduit permit tcp host <external-IP> eq ftp any

I also tried "fixup protocol ftp 21" and "no fixup protocol 20"; as they didn't work, I removed them.

It connects successfully, I type my username and password just fine. When I try any command I get:

C:\>ftp <server-name>
Connected to <server-name>.
220 Microsoft FTP Service
User (<server-name>:(none)): <username>
331 Password required for <username>.
Password:
230 User <username> logged in.
ftp> dir
500 Invalid PORT Command.
150 Opening ASCII mode data connection for /bin/ls.

And it sits there forever. I can see on eventvwr that the server drops the connection after the time-out I configured is reached.

If I try from Internet Explorer I get a message box:

200 Type set to A
500 Invalid PORT command
500 'LPRT 6,16,0,0,0,0,0,0,0,0,9,4,0,0,0,0,34,113,2,6,71': command not understood

FTP to this server from inside my LAN works fine.

Can anyone help me? Thanks a lot!

share|improve this question
1  
What version of PIX firmware are you running 6,7 or 8? –  Zypher Jul 15 '09 at 14:02
    
I'm using PIX Version 5.1(4) –  Andre Luis Jul 15 '09 at 14:40
    
It would be a nice idea to upgrade it ! –  radius Jul 15 '09 at 15:21
    
Do your pix logs show anything? fixup protocol ftp 21 should be all you need –  Adam Jul 15 '09 at 15:23
    
Thank you radius! –  Andre Luis Jul 15 '09 at 15:30

1 Answer 1

Remove:

fixup protocol ftp 20

and just add:

fixup protocol ftp

without a port number. A port number is not needed. In addition to this, you may need to issue a clear xlate for it to take effect right away...however, this will disconnect any/all active connections (and can cause other issues).

Edited to add:

As Zephyr asked in comments above, it is important to know what version of PIX software you're running as Cisco replaced fixup with inspect.

share|improve this answer
    
He said : "I also tried "fixup protocol ftp 21" and "no fixup protocol 20"; as they didn't work, I removed them.". I made the same answer before reding the question a second time ;) –  radius Jul 15 '09 at 14:14
    
But I also suspect that he did this and tried them right away before trying clear xlate. –  GregD Jul 15 '09 at 14:17
    
When I try "fixup protocol ftp" it returns an error message: "usage: [no] fixup protocol <prot> <port>[-<port>]" –  Andre Luis Jul 15 '09 at 14:41
    
I googled clear xlate and I don't think it is necessary because the command "static (inside,outside) <external-IP> <internal-IP> netmask 255.255.255.255 0 0" was already in place –  Andre Luis Jul 15 '09 at 14:45
    
What does a "show fixup" return? –  GregD Jul 15 '09 at 16:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.